Homepage Hijack

[Jim]

I have had my homepage hijacked. it keeps changing from
my selection to about:blank. not only that but my about
blank was changed to some search site thing that i dont
like AND whenever i open ANY kind of window, annoying
spyware scanner popups (ironic) pop up. spybot and
adaware didnt work, im getting to my whits end, please
help me...

 

[Kelly]

Hi,

Try:

Hijack This
http://www.spychecker.com/program/hijackthis.html

Free Online Virus Scan
http://housecall.trendmicro.com/housecall/start_corp.asp

 

[Guest]

Jim,

Please see the following instructions:

Spyware Removal:
http://www.fixyourwindows.com/windowsxpsolutions.htm

Startup and Temporary Files Cleanup:
http://www.fixyourwindows.com/optimizewindows.htm

Good Luck!

 

[Jim]

I have hijackthis, i just dont have enough computer
experience to use it, is there something that will tell
me what i have to delete with it?

 

[Kelly]

Hi Jim,

Download the progrom, hit Scan, put a checkbox in what isn't needed, then
click Fix Checked. To get more info on each entry, click on Info for
selected item.

Other than that, capture a screen shot and send it to me via e-mail.




I have hijackthis, i just dont have enough computer
experience to use it, is there something that will tell
me what i have to delete with it?

 

[Guest]

I have had my homepage hijacked. it keeps changing from
my selection to about:blank. not only that but my about
blank was changed to some search site thing that i dont
like AND whenever i open ANY kind of window, annoying
spyware scanner popups (ironic) pop up. spybot and
adaware didnt work, im getting to my whits end, please
help me...

Sounds similar to what happened to me two days ago,Ad-aware/spybot CWShredder/hijackthis removes it but it will recreate itself in about 1.2 seconds
I can't say that this will work for you there are many variants of cool web search But I removed "DPFI.DLL" from the system32 folder and placed it in a temp. folder then deleted this temp file (you might need to do this in safe mode)
Right click on start and select explore navigate to the name of your user account
then local settings,and delete the contents of the temp. folder. So far it hasn't returned.If DPFI.DLL is in your system32 folder you might give this a try also in internet options>security>custom level set "Download signed and unsigned" Active X controls to prompt. And disable Active X controls not marked as safe.

 

[Alan D.]

Hi Jim,
This is exactly same situation that happened to me couple of weeks ago. As
suggested by other reader, you have a case of "Cool Web Search" hijacking.
All you have to do (and this worked for me perfectly) is to find a program
called CWShredder and this will take care of the problem. I'm at work right
now and cannot access the link to the exact page where you can find it, but
if you still have problems, e'mail me directly in the evening and I will
send you back either the program itself or a link where you can download it
from. Good luck.

Best regards,

Alan D.

P.S. Personally, I wouldn't play with manually removing any DLL files,
unless you know for sure what you're doing. Try to find the CWSredder and
it'll solve your problem. Also, run some kind of spyware protecting software
like SpyBot all the time (update it from time to time). Good luck.

 

[Alan D.]

Jim,
Actually, you can find the CWSshredder here (I found this in one of the post
before yours):
http://www.spywareinfo.com/~merijn/downloads.html

Hope this solves your problem,

Best regards,

Alan D.